diff --git a/scripts/setup-pr-quality-ruleset.sh b/scripts/setup-pr-quality-ruleset.sh
index 5caf3880..bb967ade 100755
--- a/scripts/setup-pr-quality-ruleset.sh
+++ b/scripts/setup-pr-quality-ruleset.sh
@@ -47,6 +47,10 @@ gh auth status >/dev/null 2>&1 || { echo "Error: gh not authenticated" >&2; exit
 EXISTING_ID=$(gh api "repos/$REPO/rulesets?includes_parents=false" -q ".[] | select(.name == \"$RULESET_NAME\") | .id" 2>/dev/null || echo "")
 
 # ── Ruleset payload (used for both create and update) ─────────────────────────
+# Compliance-pinned parameters (do not relax — enforced by scripts/tests/
+# setup-pr-quality-ruleset.test.js and the weekly compliance audit):
+#   dismiss_stale_reviews_on_push: true   (issue #555)
+#   require_last_push_approval:    true   (issue #539)
 RULESET_PAYLOAD=$(cat <<'JSON'
 {
   "name": "pr-quality",
diff --git a/scripts/tests/setup-pr-quality-ruleset.test.js b/scripts/tests/setup-pr-quality-ruleset.test.js
index 4fa7ddfe..008ea2e8 100644
--- a/scripts/tests/setup-pr-quality-ruleset.test.js
+++ b/scripts/tests/setup-pr-quality-ruleset.test.js
@@ -3,7 +3,9 @@ const path = require('path')
 
 // Extracts the JSON payload from the heredoc in setup-pr-quality-ruleset.sh.
 // The script codifies the org-standard "pr-quality" ruleset; this test guards
-// against configuration drift of the ruleset parameters (see issue #520).
+// against configuration drift of the ruleset parameters. Compliance findings
+// this guard protects against: #520 (initial drift guard), #539
+// (require_last_push_approval), #555 (dismiss_stale_reviews_on_push).
 function loadRulesetPayload() {
   const scriptPath = path.join(__dirname, '..', 'setup-pr-quality-ruleset.sh')
   const script = fs.readFileSync(scriptPath, 'utf8')